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Device for recording data, record carrier and method for recording data 



The invention relates to a device for recording data on a track of a record 
carrier, which record carrier comprises a first keylocker which holds information about the 
data and a second keylocker which holds the same information, which two keylockers are 
positioned adjacent to each other on the track, the device comprising invalidating means for 

5 invalidating the keylockers. 

The invention further relates to a record carrier having a track for recording 
data, the record carrier comprising a first keylocker which holds information about the data 
and a second keylocker which holds the same information, the two keylockers being 
positioned adjacent to each other on the track. 

10 The invention also relates to a method of recording data on a track of a record 

carrier, which record carrier comprises a first keylocker which holds information about the 
data and a second keylocker which holds the same information, the two keylockers being 
positioned adjacent to each other on the track, the method comprising a step of invalidating 
the keylockers. 

15 

As copying of data in the form of copyrighted material from one record carrier 
to an other becomes more and more easy, the need for proper protection of that data becomes 
greater. An example of a scheme to protect data uses a so-called keylocker. In a keylocker all 

20 secrets, for example usage rights, keys, counters, a unique identification of the disc or any 
information are stored in the keylocker in a tamper-free way. Usage rights may be, for 
example, the rights to play or copy the data on the record carrier. A keylocker is encrypted 
with a so-called keylocker key. It is common to have two or more identical copies of the 
keylocker on the record carrier. If one keylocker is damaged, the other keylocker can be used. 

25 The keylockers are commonly placed adjacent to each other. 

An example of data that can be protected is music. The keylocker may contain 
the right to copy the music once. After a copy has been made, the keylocker is updated 
indicating that no more copy can be made. If the record carrier is a write once record carrier, 
or if the data is written on the record carrier in a similar way as with a write once record 
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carrier, the updating of the keylocker is done by writing new keylockers and invalidating the 
old ones. On a write once record carrier, invalidating can be done by damaging the 
keylockers with a laser pulse having a sufficiently high power level. A problem with this 
invalidation is that also the data directly adjacent to the keylockers will be damaged or will 
5 be inaccessible. The directly adjacent data can be damaged when the data is written 
interleaved on the record carrier. Interleaved writing means that the data is not written 
continuously but in blocks, which blocks are written with a spacing between them. That 
spacing may be, for example, two or three blocks of other data. When data is invalidated, 
units of data are invalidated that do not coincide with the interleave blocks. Therefore also 

1 0 data adjacent to the keylocker is invalidated. The data directly adjacent to the keylocker may 
also become inaccessible when the keylocker is invalidated because of the following reason. 
When a device such as an optical recorder wants to access certain target data on the record 
carrier, it does not jump directly to the target address of that data, but to a previous address 
before the target address. This is done because the optical recorder then has time to settle 

1 5 before the target data is read. If the data on the previous address is invalidated, however, the 
target data is inaccessible. 



It is an object of the invention to provide a device and method for recording 
20 data which is able to invalidate the keylockers without making the neighboring data 
inaccessible. 

It is also an object of the invention to provide a record carrier which contains 
keylockers that can be invalidated without making the neighboring data inaccessible. 

For this purpose, the device as described in the opening paragraph is 

25 characterized in that the invalidating means are able to invalidate the keylockers by 

invalidating an identical part of the information of the first keylocker and of the second 
keylocker, the information of the first keylocker being arranged differently from the 
information of the second keylocker in that the information that is to be invalidated of at least 
one keylocker is positioned closer to the other keylocker than in a situation in which the 

30 information of the keylockers is arranged identically. The record carrier described in the 

opening paragraph is characterized in that the keylockers can be invalidated by invalidating 
an identical part of the information of the first keylocker and of the second keylocker, the 
information of the first keylocker being arranged differently from the information of the 
second keylocker in that the information that is to be invalidated of at least one keylocker is 
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positioned closer to the other keylocker than in a situation in which the information of the 
keylockers is arranged identically. The method described in the opening paragraph is 
characterized in that the step of invalidating the keylockers invalidates the keylockers by 
invalidating an identical part of the information of the first keylocker and of the second 

5 keylocker, the information of the first keylocker being arranged differently from the 

information of the second keylocker in that the information that is to be invalidated of at least 
one keylocker is positioned closer to the other keylocker than in a situation in which the 
information of the keylockers is arranged identically. 

It is sufficient to invalidate only a part of the keylocker in order to disable the 

10 use of the keylocker. If the same part of all the keylockers is disabled, it is not possible to 
retrieve the whole keylocker. However, disabling of, for example, the first part of both 
keylockers will also disable the data preceding the first keylocker. Disabling the first part of 
the keylockers is preferable, because in practice the space reserved for the keylocker could be 
greater than the keylocker needs, resulting in the last part of the space reserved for the 

1 5 keylocker being unused. Disabling the last part would have the result that the information of 
the whole keylocker is still retrievable. If the first part of the first keylocker is arranged closer 
to the other, adjacent keylocker, then that first part is further away from the preceding data 
and the preceding data will not be damaged. This ensures a better integrity of the preceding 
data after invalidation. In an embodiment, the keylocker contains usage rights of the data. 

20 These rights may be, for example, the right to copy the data once. 

In an embodiment of the recording device, the information that is to be deleted 
of the first keylocker is directly adjacent to the information that is to be deleted of the second 
keylocker. This has the advantage that the information that is to be deleted is as far as 
possible away from the data directly neighboring the keylockers, thereby minimizing the risk 

25 of making the neighboring data inaccessible. 

In another embodiment, the information contained in the keylockers is divided 
into sectors. The part of the information that is to be invalidated preferably comprises the last 
sectors of the first keylocker and the first sectors of the second keylocker. 

In a further embodiment, the record carrier comprises more than two 

30 keylockers which are adjacent to each other, and the first keylocker and the second keylocker 
are the two outermost keylockers. Here again the part of the information that is invalidated is 
further away from the neighboring data. The arrangement of the information of the 
keylockers between the first and second keylocker is not important in this connection. 
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These and other aspects of the invention will be apparent from and elucidated 
further with reference to the embodiments described by way of example in the following 
description and with reference to the accompanying drawings, in which 
5 Fig. 1 shows a recording device, 

Fig. 2 shows an example of a keylocker area structure, 
Fig. 3a shows an example of two identical keylockers, 
Fig. 3b shows another example of two identical keylockers, 
Fig. 4 diagrammatically shows the process of writing new keylockers and 
1 0 invalidating the old keylockers, 

Fig. 5 shows an example of a corrupted sector which is directly adjacent to the 
invalidated sectors. 

15 Fig. 1 shows an embodiment of a recording system having a record carrier 1, 

rotating means 4, and a transducer 2. The transducer 2 may be, for example, an optical pickup 
unit. An optical pickup unit emits a radiation beam 3 which is reflected by the record carrier 
1 . The record carrier 1 in this example contains the data on a track 5 (see Fig. 2), which track 
5 may consists of pits that will or will not reflect the radiation beam 3. Physical elements 

20 other than pits which result in reflecting or not reflecting the radiation beam 3 may also be 
used for registering data on the track 5. The reflected radiation beam 3 is converted by the 
transducer into a signal that is further processed by further processing means in the recording 
device. The further processing means converts the signal from the transducer 2 into a 
reproduction signal which may be an audio signal, for example. The recording device also 

25 comprises invalidation means 20. The invalidation means 20 are connected to the transducer 
2 for invalidating the keylockers. In this embodiment, the record system is also capable of 
playing back a record carrier 1 . In an alternative embodiment, the recording system is capable 
of recording data on a record carrier 1, but not capable of playing back a record carrier 1 . 

In Fig. 2, a track 5 which holds a so-called keylocker area 1 1 is depicted. In 

30 this case the keylocker area 1 1 resides in the program area of the track. The program area is 
the area where the user data 6 is stored on the track 5. The track 5 in this example also has an 
unrecorded area 10. The program area thus comprises the user data 6, the keylocker area 11, 
and the unrecorded area 10. The keylocker area 1 1 consists of a first keylocker 7, a second 
keylocker 8, and a further information area 9. The further information area 9 comprises an 
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adaptation layer parameter space ALP, and may comprise an enabling key block EKB and a 
black list BL. The ALP structure comprises pointers to the keylockers. The EKB is a data 
structure that is used to communicate a secret cryptographic key to a set of authorized 
devices or PC applications. The BL is a list containing identifiers of devices or other entities 
5 that have been declared invalid. 

Figs. 3a and 3b show two examples of the keylockers 7 and 8 on a record 
carrier 1 according to the invention. In Fig. 3a, the keylockers 7 and 8 consist of eight sectors 
each. Each sector in this example contains two kilobytes of information. In Fig. 3b, the 
keylockers 7 and 8 consist of 168 sectors each. The information contained in the keylockers 7 

10 and 8 is usually encrypted. The encrypted information is stored in the keylockers starting 
from sector 1 to the last sector. Of course not all sectors need to contain encrypted 
information. Therefore, when the keylockers need to be invalidated by invalidation of an 
identical part of the encrypted information of both keylockers, the safest sectors to invalidate 
are the sectors with the lowest numbers. In this example sectors 1 and 2 are invalidated. The 

15 encrypted information of the keylockers shown in Figs. 3 a and 3b are arranged so that sectors 
1 and 2 of the first key locker 7 are directly adjacent to the sectors 1 and 2 of the second 
key locker 8. In this way there are six sectors between the invalidated sectors and the 
neighboring data, which is the maximum number of sectors if two sectors of the keylockers 
need to be invalidated. In Fig. 3b there are even more sectors between the invalidated sectors 

20 and the neighboring data. This ensures the integrity of the neighboring data after invalidation 
of the keylockers. Of course other sectors and/or an other number of sectors may also be 
invalidated. The sectors of the first keylocker 7 and the second keylocker 8 that need to be 
invalidated do not have to be adjacent, but this does have the advantage that there is a 
maximum number of sectors between the invalidated sectors and the neighboring data. This 

25 also has the further advantage that the invalidation process is relatively simple because the 
sectors can be invalidated with one continuous laser action. 

Fig. 4 shows an example of a track 5 which contains a first invalidated 
keylocker 7i and a second invalidated keylocker 8i. Also the further information area 9o is 
not used anymore. Two new keylockers 7 and 8 are written on another location on the track 

30 5. A new further information area 9 is also written, because that further information area 9 
contains pointers to the new keylockers. If the EKB and the BL need not to be updated, these 
structures can be maintained in the old further information area 9o. The new further 
information area 9 then contains pointers to the EKB and BL. 
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Fig. 5 shows an example of a sector which is directly adjacent to a sector that 
has been invalidated. The data in the sector depicted in Fig. 5 was not intended to be 
invalidated or damaged. Since the adjacent sector (not depicted in Fig. 5) was invalidated, 
however, the data in the sector depicted in Fig. 5 was damaged by accident. The reason for 

5 the damaging may be that the data is written interleaved and that invalidating of the 
keylocker invalidates also neighboring data. The data in the sector is depicted in a 
hexadecimal representation. The data which is accentuated with the black boxes is corrupted 
as a consequence of the invalidation of the adjacent sector. This clearly shows that 
invalidation must not be done directly adjacent to data which must be left intact. 

1 0 Although the invention has been explained mainly with reference to 

embodiments of an optical recording device, similar embodiments of recording devices are 
suitable which have the characteristic that invalidation of data on the record carrier also 
damages data adjacent to the invalidated data. Also, an optical disc may be used for the 
record carrier, or other media such as a magnetic disc or tape may be used. It is noted that in 

15 this document the verb 'comprise' and its derived forms do not exclude the presence of other 
elements or steps than those listed, and the word 'a' or 'an 5 preceding an element does not 
exclude the presence of a plurality of such elements, that any reference signs do not limit the 
scope of the claims, that the invention may be implemented by means of both hardware and 
software, and that several 'means' may be represented by the same item of hardware. Further, 

20 the scope of the invention is not limited to the embodiments, and the invention lies in each 
and every novel feature or combination of features described above. 



